General

  • Target

    Eternity.exe

  • Size

    905KB

  • Sample

    241104-rsvgls1dla

  • MD5

    052fb36ef29de355e3953ecbfd1c1e4d

  • SHA1

    cddd89298c10919f7d7607506e36ee3bf34969f3

  • SHA256

    0af9bf026c1f8d46723a40b2e84c0dd2203ba8fbcb80f3fca993ff9d1115fc88

  • SHA512

    6b698a179b25e7172cfb9bbca75f5642921385bb83d3f4d5a3108f369f5a563a37845dc7e9e85680002ff7a46f545c0aba834e93d42e759acf99df2b68758d56

  • SSDEEP

    12288:mTEYAsROAsrt/uxduo1jB0Y96qHWt/Mw9TCE+rL7Alh6/6Ztbiy/ZHZQuxQsxzro:mwT7rC6q+Mw9eHTAlY6Zf1Q6Hqf

Malware Config

Targets

    • Target

      Eternity.exe

    • Size

      905KB

    • MD5

      052fb36ef29de355e3953ecbfd1c1e4d

    • SHA1

      cddd89298c10919f7d7607506e36ee3bf34969f3

    • SHA256

      0af9bf026c1f8d46723a40b2e84c0dd2203ba8fbcb80f3fca993ff9d1115fc88

    • SHA512

      6b698a179b25e7172cfb9bbca75f5642921385bb83d3f4d5a3108f369f5a563a37845dc7e9e85680002ff7a46f545c0aba834e93d42e759acf99df2b68758d56

    • SSDEEP

      12288:mTEYAsROAsrt/uxduo1jB0Y96qHWt/Mw9TCE+rL7Alh6/6Ztbiy/ZHZQuxQsxzro:mwT7rC6q+Mw9eHTAlY6Zf1Q6Hqf

    • Contains code to disable Windows Defender

      A .NET executable tasked with disabling Windows Defender capabilities such as realtime monitoring, blocking at first seen, etc.

    • Detects Eternity stealer

    • Eternity

      Eternity Project is a malware kit offering an info stealer, clipper, worm, coin miner, ransomware, and DDoS bot.

    • Eternity family

    • Modifies Windows Defender Real-time Protection settings

    • Disables Task Manager via registry modification

    • Drops startup file

    • Executes dropped EXE

    • Windows security modification

MITRE ATT&CK Enterprise v15

Tasks